@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/commands/files.js

@@ -267,7 +267,7 @@ export function registerFilesCommand(program) {
     });
     files
         .command("unshare <prefix>")
-        .description("Remove a named file access grant, or remove an empty ACL row without --with.")
+        .description("Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.")
         .option("--with <principal>", "Person uid, agent uid, email address, group id, or '@all' to remove the grant")
         .action(async (prefix, opts) => {
         try {
@@ -328,17 +328,21 @@ export function registerFilesCommand(program) {
                 }
                 if (!res.ok) {
                     if (res.status === 403) {
-                        console.error(chalk.red("Not authorized to remove this ACL row"));
-                        await offerAccessLadder(canonicalPrefix, {
-                            company: files.opts().company,
-                        });
+                        console.error(chalk.red(body.error ?? "Not authorized to remove this ACL row"));
+                        console.error(chalk.dim("Ask a company admin to remove this entry."));
                     }
                     else {
                         console.error(chalk.red(body.error ?? "Unable to remove ACL row"));
                     }
                     process.exit(1);
                 }
-                console.log(chalk.green(`Removed empty ACL pattern '${canonicalPrefix}'. It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
+                const removedCount = body.removedEntries;
+                const cleanupMessage = typeof removedCount === "number" && removedCount > 0
+                    ? `Removed ${removedCount} empty ${removedCount === 1 ? "entry" : "entries"} from '${canonicalPrefix}'. `
+                    : "";
+                console.log(chalk.green(body.aclRemoved === false
+                    ? `${cleanupMessage || `Removed grantee-less entries from '${canonicalPrefix}'. `}Existing grants remain.`
+                    : `${cleanupMessage || `Removed empty ACL pattern '${canonicalPrefix}'. `}It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
                 return;
             }
             const res = await vaultApiFetch({

package/dist/commands/install-global.d.ts

@@ -1,6 +1,7 @@
 import { Command } from 'commander';
 import { AnywhereRuntimeDisabledError } from './anywhere-runtime-flag.js';
 import { type RuntimeHookTrustResult } from '../utils/hook-trust.js';
+import { type ShimPathCheck } from '../lib/windows/user-path.js';
 import { type HookTarget } from '../lib/install/claude-targets.js';
 export interface GlobalInstallOptions {
     /** HQ checkout to install from (absolute). */
@@ -28,6 +29,8 @@ export interface GlobalInstallOptions {
     marketplaceRepository?: string;
     /** Test seam for the Claude Code CLI; production uses `claude`. */
     runClaude?: (args: string[], home: string, env: NodeJS.ProcessEnv) => void;
+    /** Platform override for link creation (default process.platform). */
+    platform?: NodeJS.Platform;
 }
 /** True when an hq daemon unit (launchd plist or systemd unit) exists. */
 export declare function isDaemonInstalled(home: string, platform?: NodeJS.Platform, queryTask?: (task: string) => boolean): boolean;
@@ -58,6 +61,8 @@ export interface GlobalUninstallOptions {
     log?: (line: string) => void;
     /** Test seam for the Claude Code CLI; production uses `claude`. */
     runClaude?: (args: string[], home: string, env: NodeJS.ProcessEnv) => void;
+    /** Platform override for link creation (default process.platform). */
+    platform?: NodeJS.Platform;
 }
 /** Reverse every install step; non-HQ entries are left untouched. */
 export declare function uninstallGlobalClaude(opts?: GlobalUninstallOptions): string[];
@@ -83,6 +88,8 @@ export interface GlobalCommandOpts {
     cwd?: string;
     /** Test seam for trusting the Codex hooks a global install registers. */
     trustCodexHooks?: (cwd: string, keys: readonly string[]) => Promise<RuntimeHookTrustResult>;
+    /** Test seam: is the npm hq.cmd folder on the Windows PATH? Null off Windows. */
+    shimPathCheck?: () => ShimPathCheck | null;
 }
 export declare function resolveInstallRoot(explicit: string | undefined, options?: {
     env?: NodeJS.ProcessEnv;

package/dist/commands/install-global.js

@@ -17,6 +17,7 @@ import { seedRegistryFromHqRoot } from './link.js';
 import { resolveHqRoot } from './doctor.js';
 import { anywhereRuntimeEnabled, AnywhereRuntimeDisabledError } from './anywhere-runtime-flag.js';
 import { resolveHqMcpEndpoint } from '../lib/daemon/mcp-endpoint.js';
+import { linkDirectory, removeLinkOnly, removeSkillEntry, skillCopySource } from '../utils/safe-link.js';
 import { chatgptConnectorInstructions } from '../lib/install/chatgpt-targets.js';
 import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
 import { grokConnectorInstructions } from '../lib/install/grok-targets.js';
@@ -28,6 +29,7 @@ import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_
 import { readDaemonConfig } from '../lib/daemon/config.js';
 import { daemonPaths } from '../lib/daemon/paths.js';
 import { assertProviderWrappersInstallable, installProviderWrappers, providerWrapperInstallPaths, removeProviderWrappers } from '../lib/install/provider-wrappers.js';
+import { checkShimOnPath, shimPathWarning } from '../lib/windows/user-path.js';
 import { addAgentsMdBlock, addCodexHooks, classifyLegacySkills, codexAdapterPath, codexCharterSource, codexHookTrustKeys, codexTargets, hasAllCodexHooks, HQ_OWNED_MARKER, LEGACY_BACKUP_NAME, LEGACY_SKILLS_NAME, removeAgentsMdBlock, removeCodexHooks, } from '../lib/install/codex-targets.js';
 import { addClaudeMdBlock, addHqHooks, charterPath, claudeTargets, hasAllHqHooks, HQ_ANYWHERE_PACK, HQ_MCP_SERVER_NAME, hqSkillsSource, lineDiff, masterHookPath, shimPath, MCP_SUBPROCESS_PATH, removeClaudeMdBlock, removeHqHooks, SKILL_LINK_PREFIX, } from '../lib/install/claude-targets.js';
 /** True when an hq daemon unit (launchd plist or systemd unit) exists. */
@@ -206,6 +208,22 @@ function mcpManifest(opts) {
     }
     return { type: 'stdio', command, args: [entry, 'mcp', 'serve'], env: { PATH: MCP_SUBPROCESS_PATH } };
 }
+/**
+ * The folder an HQ skill entry stands for: a link's resolved target, or the
+ * source recorded in a marked copy. Null for anything else.
+ */
+function skillEntryTarget(skillsDir, entry) {
+    const st = fs.lstatSync(entry);
+    if (st.isSymbolicLink())
+        return path.resolve(skillsDir, fs.readlinkSync(entry));
+    return skillCopySource(entry);
+}
+function reportSkillCopies(kinds, log) {
+    const copies = kinds.filter((k) => k === 'copy').length;
+    if (copies === 0)
+        return;
+    log(`  ${copies} skill folder(s) were copied because Windows refused both a link and a junction. Copies do not follow HQ skill updates; turn on Developer Mode, then uninstall and install again to get links.`);
+}
 function skillLinkName(name) {
     return name.startsWith(SKILL_LINK_PREFIX) ? name : `${SKILL_LINK_PREFIX}${name}`;
 }
@@ -254,7 +272,7 @@ function planSkills(hqRoot, t) {
         }
         if (!st)
             plan.link.push(name);
-        else if (st.isSymbolicLink() && path.resolve(t.skillsDir, fs.readlinkSync(link)) === target)
+        else if (skillEntryTarget(t.skillsDir, link) === target)
             plan.already.push(name);
         else
             plan.skipped.push(name);
@@ -283,9 +301,8 @@ function hqSkillLinksForRoot(skillsDir, hqRoot) {
     return names.filter((name) => {
         const link = path.join(skillsDir, name);
         try {
-            if (!fs.lstatSync(link).isSymbolicLink())
-                return false;
-            return path.dirname(path.resolve(skillsDir, fs.readlinkSync(link))) === hqSkillsSource(hqRoot);
+            const target = skillEntryTarget(skillsDir, link);
+            return target !== null && path.dirname(target) === hqSkillsSource(hqRoot);
         }
         catch (error) {
             if (error.code === 'ENOENT')
@@ -301,8 +318,8 @@ function hqCompanySkillLinksForRoot(skillsDir, hqRoot) {
     const source = hqSkillsSource(hqRoot);
     return hqSkillLinksForRoot(skillsDir, hqRoot).filter((link) => {
         try {
-            const target = path.resolve(skillsDir, fs.readlinkSync(link));
-            if (path.dirname(target) !== source)
+            const target = skillEntryTarget(skillsDir, link);
+            if (target === null || path.dirname(target) !== source)
                 return false;
             const sourceName = path.basename(target);
             const separator = sourceName.indexOf(':');
@@ -492,22 +509,41 @@ export function installGlobalClaude(opts) {
             throw error;
         }
     }
-    writeFileAtomic(t.hqPointer, pointerNew);
-    if (mdOld !== mdNew) {
-        if (mdNew === null) {
-            if (fs.existsSync(t.claudeMd))
-                fs.unlinkSync(t.claudeMd);
+    // Skill links go first: they are the step most likely to fail (Windows
+    // without symlink privilege), and a failure here must not leave ~/.hq/root
+    // or the CLAUDE.md block behind. On any error, undo this run's writes.
+    const skillsDirExisted = fs.existsSync(t.skillsDir);
+    const createdLinks = [];
+    const linkKinds = [];
+    try {
+        if (!pluginSource)
+            fs.mkdirSync(t.skillsDir, { recursive: true });
+        for (const name of skills.link) {
+            const link = path.join(t.skillsDir, skillLinkName(name));
+            linkKinds.push(linkDirectory(path.join(hqSkillsSource(hqRoot), name), link, { platform: opts.platform }));
+            createdLinks.push(link);
+        }
+        writeFileAtomic(t.hqPointer, pointerNew);
+        if (mdOld !== mdNew) {
+            if (mdNew === null) {
+                if (fs.existsSync(t.claudeMd))
+                    fs.unlinkSync(t.claudeMd);
+            }
+            else
+                writeFileAtomic(t.claudeMd, mdNew);
         }
-        else
-            writeFileAtomic(t.claudeMd, mdNew);
     }
-    if (!pluginSource)
-        fs.mkdirSync(t.skillsDir, { recursive: true });
-    for (const name of skills.link) {
-        fs.symlinkSync(path.join(hqSkillsSource(hqRoot), name), path.join(t.skillsDir, skillLinkName(name)));
+    catch (error) {
+        rollbackLinkPhase({
+            createdLinks,
+            skillsDir: skillsDirExisted ? null : t.skillsDir,
+            files: [[t.hqPointer, pointerOld], [t.claudeMd, mdOld]],
+            log,
+        });
+        throw error;
     }
     for (const link of skillLinksToRemove)
-        fs.unlinkSync(link);
+        removeSkillEntry(link, log);
     if (pluginSource) {
         // Migrate a prior direct install: remove only our old hook/MCP entries while
         // retaining the original user settings for a later uninstall restore.
@@ -574,6 +610,7 @@ export function installGlobalClaude(opts) {
         installProviderWrappers(providerBin, home);
     log(`HQ installed for Claude Code from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
+    reportSkillCopies(linkKinds, log);
     reportSkippedSkills(skills, log, false);
     if (pluginSource)
         log(`  plugin: ${pluginSource.pluginId} installed from ${pluginSource.sourceDir}; direct hooks and MCP entries removed`);
@@ -584,6 +621,38 @@ export function installGlobalClaude(opts) {
     log(`  registry: ${seeded.length} manifest entr${seeded.length === 1 ? 'y' : 'ies'} seeded`);
     return touched;
 }
+/**
+ * Undo the link phase of a failed install: remove only the links this run
+ * created (never recursing into them), put each file back to its pre-run
+ * bytes, and drop the skills folder if this run created it and it is empty.
+ * A copy that is kept instead of removed is reported through `log`.
+ */
+function rollbackLinkPhase(args) {
+    for (const link of [...args.createdLinks].reverse()) {
+        try {
+            removeSkillEntry(link, args.log);
+        }
+        catch { /* keep rolling back */ }
+    }
+    for (const [file, original] of args.files) {
+        try {
+            if (original === null) {
+                if (fs.existsSync(file))
+                    fs.unlinkSync(file);
+            }
+            else if (readOrNull(file) !== original)
+                writeFileAtomic(file, original);
+        }
+        catch { /* keep rolling back */ }
+    }
+    if (args.skillsDir) {
+        try {
+            if (fs.readdirSync(args.skillsDir).length === 0)
+                fs.rmdirSync(args.skillsDir);
+        }
+        catch { /* keep rolling back */ }
+    }
+}
 /** Reverse every install step; non-HQ entries are left untouched. */
 export function uninstallGlobalClaude(opts = {}) {
     const home = resolveEnv({ home: opts.home }).home;
@@ -621,11 +690,11 @@ export function uninstallGlobalClaude(opts = {}) {
     const links = [];
     try {
         for (const d of fs.readdirSync(t.skillsDir, { withFileTypes: true })) {
-            if (!d.name.startsWith(SKILL_LINK_PREFIX) || !d.isSymbolicLink())
+            if (!d.name.startsWith(SKILL_LINK_PREFIX) || !(d.isSymbolicLink() || d.isDirectory()))
                 continue;
             const link = path.join(t.skillsDir, d.name);
-            const target = path.resolve(t.skillsDir, fs.readlinkSync(link));
-            if (path.dirname(target) === source)
+            const target = skillEntryTarget(t.skillsDir, link);
+            if (target !== null && path.dirname(target) === source)
                 links.push(link);
         }
     }
@@ -693,7 +762,7 @@ export function uninstallGlobalClaude(opts = {}) {
         }
     }
     for (const link of links)
-        fs.unlinkSync(link);
+        removeSkillEntry(link, log);
     if (md !== null && mdNext !== md) {
         if (mdNext === null || (mdNext === '' && state?.claudeMd.original == null))
             fs.unlinkSync(t.claudeMd);
@@ -842,12 +911,34 @@ export function installGlobalCodex(opts) {
         log(lineDiff(codexConfigFormat.serialize(tomlDoc), codexConfigFormat.serialize(tomlNext)));
         return touched;
     }
-    writeFileAtomic(hqPointer, pointerNew);
-    writeFileAtomic(t.agentsMd, mdNew);
+    // Skill links go first so a link failure leaves no pointer or AGENTS.md
+    // block behind (see installGlobalClaude).
+    const skillsDirExisted = fs.existsSync(t.skillsDir);
+    const createdLinks = [];
+    const linkKinds = [];
+    try {
+        fs.mkdirSync(t.skillsDir, { recursive: true });
+        for (const name of skills.link) {
+            const link = path.join(t.skillsDir, skillLinkName(name));
+            linkKinds.push(linkDirectory(path.join(hqSkillsSource(hqRoot), name), link, { platform: opts.platform }));
+            createdLinks.push(link);
+        }
+        writeFileAtomic(hqPointer, pointerNew);
+        writeFileAtomic(t.agentsMd, mdNew);
+    }
+    catch (error) {
+        rollbackLinkPhase({
+            createdLinks,
+            skillsDir: skillsDirExisted ? null : t.skillsDir,
+            files: [[hqPointer, pointerOld], [t.agentsMd, mdOld]],
+            log,
+        });
+        throw error;
+    }
     // Legacy mirror: replace only when HQ-owned; record enough to put it back.
     let legacyRecord = prior?.legacy ?? { kind: 'none' };
     if (legacy.kind === 'hq-symlink') {
-        fs.unlinkSync(legacyPath);
+        removeLinkOnly(legacyPath);
         legacyRecord = { kind: 'symlink', target: legacy.target };
     }
     else if (legacy.kind === 'hq-dir') {
@@ -857,12 +948,8 @@ export function installGlobalCodex(opts) {
     }
     else if (legacy.kind === 'foreign')
         log(legacyWarning(t.skillsDir));
-    fs.mkdirSync(t.skillsDir, { recursive: true });
-    for (const name of skills.link) {
-        fs.symlinkSync(path.join(hqSkillsSource(hqRoot), name), path.join(t.skillsDir, skillLinkName(name)));
-    }
     for (const link of companySkillLinksToRemove)
-        fs.unlinkSync(link);
+        removeSkillEntry(link, log);
     writeConfigAtomic({
         target: t.hooksJson,
         pack: HQ_ANYWHERE_PACK,
@@ -905,6 +992,7 @@ export function installGlobalCodex(opts) {
         installProviderWrappers(providerBin, home);
     log(`HQ installed for Codex from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
+    reportSkillCopies(linkKinds, log);
     reportSkippedSkills(skills, log, false);
     log(`  hooks: ${hookTarget === 'shim' ? shimPath(hqRoot) : codexAdapterPath(hqRoot)} registered in ${t.hooksJson}`);
     log(`  MCP: "${HQ_MCP_SERVER_NAME}" registered in ${t.configToml}`);
@@ -943,11 +1031,11 @@ export function uninstallGlobalCodex(opts = {}) {
     const links = [];
     try {
         for (const d of fs.readdirSync(t.skillsDir, { withFileTypes: true })) {
-            if (!d.name.startsWith(SKILL_LINK_PREFIX) || !d.isSymbolicLink())
+            if (!d.name.startsWith(SKILL_LINK_PREFIX) || !(d.isSymbolicLink() || d.isDirectory()))
                 continue;
             const link = path.join(t.skillsDir, d.name);
-            const target = path.resolve(t.skillsDir, fs.readlinkSync(link));
-            if (path.dirname(target) === source)
+            const target = skillEntryTarget(t.skillsDir, link);
+            if (target !== null && path.dirname(target) === source)
                 links.push(link);
         }
     }
@@ -1012,10 +1100,10 @@ export function uninstallGlobalCodex(opts = {}) {
         }
     }
     for (const link of links)
-        fs.unlinkSync(link);
+        removeSkillEntry(link, log);
     if (restoreLegacy && state) {
         if (state.legacy.kind === 'symlink')
-            fs.symlinkSync(state.legacy.target, legacyPath);
+            linkDirectory(state.legacy.target, legacyPath, { platform: opts.platform, allowCopy: false });
         else if (state.legacy.kind === 'dir' && fs.existsSync(state.legacy.backup))
             fs.renameSync(state.legacy.backup, legacyPath);
     }
@@ -1124,6 +1212,12 @@ export async function runInstallGlobal(opts) {
     });
     if (runtime === 'codex' && !opts.dryRun)
         await trustInstalledCodexHooks(hqRoot, opts);
+    if (!opts.dryRun) {
+        const shimPath = (opts.shimPathCheck ?? (() => checkShimOnPath({ env })))();
+        if (shimPath)
+            for (const line of shimPathWarning(shimPath))
+                (opts.log ?? console.log)(line);
+    }
 }
 /**
  * Codex skips untrusted hooks, so the hooks.json entries written above do

package/dist/commands/lanes-shared.d.ts

@@ -1,7 +1,7 @@
 import type { LaneCompanyRef, LanePlacementPolicy, LaneRecord, LanesConfig, QuestionAnswer, QuestionBody, QuestionRecord, SeniorRef, AccountHistoryEntry, LaneAccountSelection, PendingResume, QueuedReason, ResolvedLaneWorker, LivenessDeps, MachineIdentity, MonitorEvidenceReader, ReconcileHost, RunCommand, ThrottleDeps, withLaneAdmissionLock, withLaneHireLocks } from "../lib/lanes/index.js";
 import type { OutpostIdentity } from "../lib/lanes/admission-host.js";
 import type { OutpostDispatchResult } from "../lib/lanes/outpost-dispatch.js";
-import type { CpuBusySource } from "../lib/lanes/throttle.js";
+import type { CpuBusySource, MemoryHold } from "../lib/lanes/throttle.js";
 import type { ProbeCommand } from "../lib/lanes/models.js";
 import type { FocusGuardReason } from "../lib/lanes/focus-guard.js";
 import type { KillProcessFn, ProveDetachedFn, SpawnProcessFn } from "../lib/lanes/spawn.js";
@@ -100,6 +100,8 @@ export interface AdmissionResult {
         last_busy: number | null;
         busy_source: CpuBusySource | undefined;
         sampled_at: string | undefined;
+        /** Present when the memory gate holds: the signal, its value and the threshold. */
+        memory_hold?: MemoryHold;
     };
 }
 export interface PrepareAccountMoveInput {

package/dist/commands/lanes.d.ts

@@ -136,12 +136,12 @@ export declare function casUpdateLane(hqRoot: string, laneId: string, updater: (
  * reconcile pass resumes the lane once every question is answered.
  */
 export declare function checkpointInstruction(worker: Pick<ResolvedLaneWorker, "approvalRequired" | "humanCheckpoints">): string;
-export declare function composeWorkerBrief(worker: ResolvedLaneWorker, taskBrief: string): string;
+export declare function composeWorkerBrief(worker: ResolvedLaneWorker, taskBrief: string, hqRoot: string): string;
 /**
- * A lane with no worker still carries the standing authorization paragraph
- * and the foreground-only rule.
+ * A lane with no worker still carries the standing authorization paragraph,
+ * the foreground-only rule and the temp-home rule.
  */
-export declare function composeGeneralBrief(taskBrief: string): string;
+export declare function composeGeneralBrief(taskBrief: string, hqRoot: string): string;
 export declare const DISPATCH_TERMINAL_REASON: "outpost_dispatch_failed";
 /**
  * The CAS updater a pickup failure applies. A lane that is already terminal